# easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via Candidate-Supplied URLs

- **ID:** WPSEC-2026-1827
- **Plugin:** easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution (`easyjobs`), https://wordpress.org/plugins/easyjobs/
- **Affected versions:** all versions before 2.8.5
- **Fixed in:** 2.8.5 (Update to 2.8.5 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easyjobs
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1827/

## Description

The easy.jobs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via candidate-supplied URLs (such as video links, attachments and message links) in all versions up to, and including, 2.8.4. This is due to an insufficient URL scheme check that could be bypassed with control characters (e.g. 'java\nscript:'), and to arbitrary URLs being embedded in iframes or used directly as links in the candidate screens of wp-admin. This makes it possible for unauthenticated attackers who submit a job application to inject scripts that execute in an administrator's browser when they view the candidate and interact with the malicious link or embed.

## References

- https://wpsec.com/vuln/WPSEC-2026-1827/
- https://plugins.svn.wordpress.org/easyjobs/tags/2.8.5/
- https://wordpress.org/plugins/easyjobs/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1827/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.